base-upsun-httplog-logs
Log parser
- Version
- 0.1
Install with a top-level collection
1 collection include itsudo cscli collections install crowdsecurity/upsunInstalls 3 parsers and 48 scenarios.
View Upsun →Installation
sudo cscli parsers install crowdsecurity/base-upsun-httplog-logsThen reload CrowdSec: sudo systemctl reload crowdsec
Sign in to see which of your engines run it →Configuration
Hover a line or a note to see what each field does.
filter: "evt.Line.Labels.type == 'upsun-httplog'"onsuccess: next_stagepattern_syntax:UPSUN_APP_PREFIX: '^%{DATA:appname}\.%{INT:app_instance}'name: crowdsecurity/base-upsun-httplog-logsnodes:- filter: UnmarshalJSON(evt.Line.Raw, evt.Unmarshaled, "upsunMsg") in ["", nil]grok:pattern: '%{UPSUN_APP_PREFIX} %{WORD:program}: %{GREEDYDATA:message}'expression: evt.Unmarshaled.upsunMsg.message#if the node was successfull, statics will be applied.statics:- meta: machineexpression: evt.Parsed.logsource- parsed: "logsource"value: "upsun-httplog"- meta: datasource_pathexpression: evt.Line.Src- meta: datasource_typeexpression: evt.Line.Module- meta: upsunEnvexpression: evt.Unmarshaled.upsunMsg.metadata.environment- meta: upsunProjectexpression: evt.Unmarshaled.upsunMsg.metadata.project
Installed on
Know where it runs
Sign in to see the Security Engines that run this log parser, the version they run and whether it was modified locally.
Documentation
Upsun HTTP logs parser
This is the base parser for Upsun HTTP logs received via the HTTP logs integration. It parses the structured logs from Upsun applications and extracts relevant metadata.
Requirements
When using this parser, you need to specify in your acquis.yaml the type upsun-httplog. The parser will extract the application name, instance, and other metadata from the structured Upsun log format.
It's recommended to install it via the upsun collection
Example configuration
1source: http2listen_addr: 127.0.0.1:88883path: /4auth_type: headers5headers:6 crowdsecLogForward: yourHeaderHere7labels:8 type: upsun-httplog9log-level: warn
The parser extracts:
- Application name and instance from the log prefix
- Program name from the structured message
- Environment and project metadata from Upsun
- Datasource information for downstream processing
This parser is designed to work with the Upsun collection and processes logs sent via HTTP from Upsun's logging integration.